Shell Execution via Find - Linux

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•3•0•25

Detects the use of the 'find' command in Linux to execute a shell. This behavior is often associated with privilege escalation, unauthorized command execution, or exploitation attempts, particularly when leveraging misconfigurations or vulnerabilities to break out of restricted environments.